This sample came to us from ISC reader Joe, who reported that his
Acrobat reader had crashed with the error message "A 3D parsing error
has occurred". The obfuscation approach used by this sample isn't brand
new, this type has been around since about mid December as far as we
know. No matter, this ISC diary is not about breaking news, more about
analysis technique.

This document defines an "action" which triggers when the document is
opened. The corresponding code is in Section 6 of this PDF. Looking at
this section, we see that this is indeed a JavaScript block, but the
actual code resides in section 7

That's more like it! Here we actually get JavaScript code ... and this
code is probably the reason why some of the automated analyzers fail:
This isn't simple JavaScript, it makes use of Adobe Acrobat specific
JavaScript objects and methods to refer to the currently loaded document
(app.doc), to identify any "annotations" within this document
(syncAnnotScan), to access the first annotation (getAnnots), to assign
it to a variable, and finally to eval (run) the code within this
variable.

When we ran pdf-parser.py -a
above, it showed "/Annot 2: 5,
9", indicating two annotation sections, 5 and 9. This script
accesses the first annotation, thus section 5. Looking into section 5,
we see that it simply refers to section 8 .. and there, finally, we find
the code block

Note how it makes use of "arguments.callee",
an anti-debugging technique that we covered before.
Also note how the code is again dependent on the presence of the "app"
object... which is Adobe specific, and won't exist in Spidermonkey. But
all you have to do to get past this stage in SpiderMonkey is to first
define the app variable (set it to anything you like, app=1 works fine),
and then to use your normal trick to get past the "arguments.callee"
trap. I still like to use the copy of SpiderMonkey that I patched to
print on every eval call.

Phew! Yes indeed. Considering the complexity of all this, it is
probably no surprise that we are seeing such an increase of malware
wrapped into PDFs ... and also no surprise that Anti-Virus tools are
doing such a shoddy job at detecting these PDFs as malicious: It is darn
hard. For now, AV tools tend to focus more on the outcome and try to
catch the EXEs written to disk once the PDF exploit was successful. But
given that more and more users no longer reboot their PC, and just
basically put it into sleep mode between uses, the bad guys do not
really need to strive for a persistent (on-disk) infection anymore.
In-memory infection is perfectly "good enough" - the average user
certainly won't reboot his PC between leisure surfing and online banking
sessions. Anti-Virus tools that miss the exploit but are hopeful to
catch the EXE written to disk won't do much good anymore in the near
future.